Bug 21591 - SEGV on unknown address 0x000000000000 in versados_scan
Summary: SEGV on unknown address 0x000000000000 in versados_scan
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.29
: P2 critical
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2017-06-13 22:29 UTC by Alexandre Adamski
Modified: 2017-06-14 09:38 UTC (History)
1 user (show)

See Also:
Last reconfirmed:

testcase (20 bytes, text/x-matlab)
2017-06-13 22:29 UTC, Alexandre Adamski
report (516 bytes, text/plain)
2017-06-13 22:30 UTC, Alexandre Adamski

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandre Adamski 2017-06-13 22:29:28 UTC
Hello there,

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror.

The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.

Let me know if there is any additional information I can provide.


Input: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.min
Output: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.txt

Error in "versados_scan": SEGV on unknown address 0x000000000000 (pc 0x00000173e11e bp 0x7fffffffe130 sp 0x7fffffffdda0 T0)
  in versados_scan at bfd/versados.c:538
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L538)
  in versados_object_p at bfd/versados.c:645
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L645)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Comment 1 Alexandre Adamski 2017-06-13 22:29:56 UTC
Created attachment 10130 [details]
Comment 2 Alexandre Adamski 2017-06-13 22:30:30 UTC
Created attachment 10131 [details]
Comment 3 cvs-commit@gcc.gnu.org 2017-06-14 09:36:20 UTC
The master branch has been updated by Nick Clifton <nickc@sourceware.org>:


commit 04f963fd489cae724a60140e13984415c205f4ac
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 14 10:35:16 2017 +0100

    Fix seg-faults in objdump when disassembling a corrupt versados binary.
    	PR binutils/21591
    	* versados.c (versados_mkobject): Zero the allocated tdata structure.
    	(process_otr): Check for an invalid offset in the otr structure.
Comment 4 Nick Clifton 2017-06-14 09:38:38 UTC
Hi Aadamski,

  Thanks for reporting this bug.  There were a couple of problems in the versados parser that led to this failure, but I have checked in a patch which should fix them.